CS0-003 Practice Test 11 — 15 Questions

Question 1

A security analyst is using Burp Suite to test a web application for vulnerabilities. Which TWO of the following are common web application vulnerabilities that can be detected using Burp Suite? (Select TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cross-site scripting (XSS). Burp Suite can detect SQL injection and XSS through its scanner and manual testing tools. Buffer overflow and race conditions are typically not web application vulnerabilities detected by web proxies. Insecure deserialization can be detected but is less common than SQLi and XSS.

Answer

Buffer overflow

Answer

Insecure deserialization

Answer

Race condition

Question 2

A security analyst is responding to a potential data exfiltration incident. As part of the containment strategy, the analyst must preserve evidence. Which TWO actions should the analyst take before containment? (Select two.)

Accepted Answer

Capture a forensic image of the affected systems. Forensic imaging of the affected systems captures the state before containment actions alter it. Recording current network connections captures volatile evidence that may be lost when the system is isolated.

Answer

Change passwords for affected accounts

Answer

Disconnect the system from the network

Answer

Kill malicious processes

Question 3

During a forensic investigation, an analyst must acquire digital evidence while maintaining forensic soundness. Which THREE practices should the analyst follow? (Choose three.)

Accepted Answer

Verify the hash of the image against the original. Write blockers prevent modification, hash verification ensures integrity, and proper documentation maintains chain of custody.

Answer

Use the suspect's operating system to copy files

Answer

Power on the system to capture volatile data first

Question 4

During a memory forensics investigation, a security analyst identifies a process that appears to have code injected into it. The process is 'explorer.exe' and its memory contains sections that are not part of the original executable. Which TWO memory analysis techniques should the analyst use to confirm code injection?

Accepted Answer

Scan for executable memory pages not backed by a file on disk. Comparing the process's loaded DLL list with the expected list can reveal anomalies. Checking for executable memory pages that are not backed by a known module is another indicator.

Answer

List the process's open handles

Answer

Examine the process's environment variables

Answer

Check the process's parent process

Question 5

An organization's incident response team is classifying an incident based on severity and priority. Which TWO factors should the team consider when determining the priority of an incident? (Select TWO.)

Accepted Answer

The potential business impact of the incident.. Priority is often based on the criticality of the affected assets and the potential business impact, as these determine how quickly the incident needs to be addressed.

Answer

The number of users reporting the issue.

Answer

The time of day the incident occurred.

Answer

The type of threat actor involved.

Question 6

Which three of the following are key considerations when implementing a vulnerability management lifecycle in an enterprise environment? (Choose three.)

Accepted Answer

Integrating threat intelligence feeds to contextualize vulnerabilities and focus on active threats. Establishing a remediation prioritization framework based on asset criticality and exploitability is correct because it ensures that vulnerabilities posing the greatest risk to the business are addressed first. This aligns with risk-based vulnerability management, where not all vulnerabilities are equal; prioritizing by asset value and exploitability (e.g., CVSS exploitability metrics or active exploitation evidence) optimizes resource allocation and reduces overall risk exposure.

Answer

Scanning all assets with the highest possible scan intensity to ensure no vulnerability is missed

Answer

Using default scan credentials from the vulnerability scanner vendor for consistency

Answer

Performing vulnerability scans only during off-peak hours to minimize network disruption

Question 7

During a security incident, a digital forensics investigator must preserve evidence according to best practices. Which three of the following actions align with proper forensic procedures? (Choose three.)

Accepted Answer

Calculate and document cryptographic hashes of acquired images.. Calculating and documenting cryptographic hashes (e.g., SHA-256) of acquired images ensures data integrity by providing a verifiable fingerprint that can prove the image has not been altered since acquisition. Maintaining a documented chain of custody tracks every person who handled the evidence, preserving its admissibility in legal proceedings. Using a write blocker when creating disk images prevents any accidental writes to the original media, which is critical to avoid altering the evidence.

Answer

Store original evidence on the same network as the investigation.

Answer

Reinstall the operating system before imaging to ensure stability.

Answer

Boot the suspect system to check for running processes.

Question 8

A security team is implementing container security scanning in their CI/CD pipeline. They want to scan container images for vulnerabilities and Kubernetes misconfigurations. Which THREE tools from the following list are best suited for this purpose? (Select THREE)

Accepted Answer

Trivy. Trivy, Clair, and Snyk are all container image scanning tools. OpenSCAP is for compliance scanning of hosts, not containers. Burp Suite is a web application DAST tool.

Answer

Burp Suite

Answer

OpenSCAP

Question 9

A security analyst is configuring a vulnerability scanner for an internal network. Which two settings are most important for reducing false positives during the scan? (Choose two.)

Accepted Answer

Disabling unnecessary plug-ins. Credentialed scans access system details for accurate results, and appropriate plug-in selection reduces irrelevant checks.

Answer

Using a higher scan intensity

Answer

Scanning from multiple IP addresses

Answer

Scanning only during business hours

Question 10

During a post-incident review, a security analyst identifies that the mean time to detect (MTTD) for incidents is significantly higher than the industry benchmark. Which THREE actions should the analyst recommend to improve detection capabilities?

Accepted Answer

Implement additional network monitoring sensors.. Updating detection rules, integrating threat intelligence, and improving monitoring coverage directly reduce detection time.

Answer

Increase the frequency of vulnerability scans.

Answer

Reduce the retention period for logs.

Question 11

A security analyst is selecting tools for vulnerability management. Which THREE of the following are vulnerability scanning tools?

Accepted Answer

Nessus. Nessus, Qualys, and OpenVAS are well-known vulnerability scanners. Lynis is a security auditing tool for hardening, but not primarily a vulnerability scanner, and Wireshark is a network protocol analyzer.

Answer

Lynis

Answer

Wireshark

Question 12

An organization is implementing a patch management process. Which THREE of the following are essential steps that should be included before deploying patches to production systems? (Select the three best answers.)

Accepted Answer

Testing patches in a staging environment. Staging environment testing, regression testing, and vendor advisory review are key pre-deployment steps.

Answer

Deploying patches directly to all production systems simultaneously

Answer

Disabling all security controls to avoid conflicts

Question 13

A cybersecurity analyst is preparing an incident report after a data breach. Which TWO components are essential to include? (Select TWO.)

Accepted Answer

Root cause. Root cause and timeline are standard components of incident reports.

Answer

Budget forecast

Answer

Employee performance review

Answer

Marketing analysis

Question 14

After a security incident involving a ransomware attack, the organization needs to communicate with various stakeholders. Which THREE of the following are appropriate actions? (Select THREE.)

Accepted Answer

Place legal holds on relevant data. Customer notification, law enforcement coordination, and legal holds are key communication steps during incidents.

Answer

Delete all logs to prevent data leakage

Answer

Publish details on social media immediately

Question 15

A security analyst is reviewing network traffic and suspects a host is infected with malware that uses a domain generation algorithm (DGA) for C2 communication. Which two of the following indicators are most consistent with DGA activity?

Accepted Answer

Frequent DNS queries to domains with random-looking, long subdomains. DGA domains are often algorithmically generated, resulting in random-looking, long domain names. High NXDOMAIN rates occur because many generated domains are not registered at the time of query.

Answer

All DNS queries are to internal DNS servers

Answer

DNS queries to domains with a high Alexa ranking

Answer

Consistent DNS query intervals to a single IP